Lucene search

GoogleOSV:CVE-2024-23344

HistoryFeb 06, 2024 - 4:15 p.m.

CVE-2024-23344

2024-02-0616:15:52

Google

osv.dev

tuleap

access control

vulnerability

patch

version 15.4.99.140

software

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.6

Confidence

Low

EPSS

0.001

Percentile

25.7%

JSON

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Some users might get access to restricted information when a process validates the permissions of multiple users (e.g. mail notifications). This issue has been patched in version 15.4.99.140 of Tuleap Community Edition.

References

github.com/Enalean/tuleap/commit/0329e21d268510bc00fed707406103edabf10e42

github.com/Enalean/tuleap/security/advisories/GHSA-m3v5-2j5q-x85w

tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=0329e21d268510bc00fed707406103edabf10e42

tuleap.net/plugins/tracker/?aid=35862

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.6

Confidence

Low

EPSS

0.001

Percentile

25.7%

JSON

Related for OSV:CVE-2024-23344